Policies

The West Midlands Combined Authority (WMCA) is a data controller in terms of the Data Protection Act. We collect, process and store a wide range of information, including personal information to deliver our services efficiently.

We are responsible for managing the information that we hold and we recognise that this information is important to you. We take our responsibilities seriously and use personal information fairly, correctly and safely in line with the UK’s data protection laws.

Anyone who receives information from us is also under a legal obligation to do the same and will have a set of data protection clauses included in any contract with us.

Where we need to share sensitive or confidential information, we will do so only with your consent or where we are legally able to do so.

Why we need to collect information about you

We collect and process various categories of personal information at the start of, and for the duration of your relationship with us. We will limit the collection and processing of information to information necessary to achieve one or more legitimate purposes as identified in this notice.

We will use your personal information for a limited number of purposes and always in line with our responsibilities, and where reasonable your wishes, where there is a legal basis to use your personal information and in relation to your rights.

We process personal information:

• For the purpose for which you provided the information, e.g. to provide you with a Swift Travel Card;
• To enable us to communicate with you and for the provision of services to you;
• To monitor our performance in providing services to you, to gather statistical information to allow us to plan future provision of services to and to obtain your opinion about our services;
• To meet various legal requirements;
• For the prevention and/or detection of crime;
• To process financial transactions including grants, payments and benefits directly involving us or where we are acting on behalf of other government bodies such as Department for Work and Pensions;
• For general processing where you have given your consent for us to do so;
• Where it is permitted under the Data Protection Act, for example, to comply with legal obligations, or for us to seek legal advice or undertake legal proceedings;
• For marketing purposes to keep you updated on the latest news and services;
• To inform you of network disruption.

We may not be able to provide you with a service if we do not have enough information and, in some instances, your consent to use that information.

We aim to keep your information accurate and up to date. You can help us to do this by letting us know if any of the information you have given us, such as your address changes. Our contact details can be found later in this document.

Schedule A, below explains the lawful basis we process your information.

Ways in which we collect your information

Face to Face
We may keep a record of your visit to us to assist us in the delivery and improvement of the services that we provide to you and to others. Any such records that include personal information will be kept securely.

Telephone calls
Ordinarily we will inform you if we record or monitor any telephone calls you make to us. We may do this to increase your security; so that we have a record of a call taking place and/or for training and quality purposes.

Emails
If you email us we may keep your email as record that you have made contact. This includes your email address. We will not include any personal or otherwise confidential information in any email we send to you unless it is sent securely or you have agreed to us contacting you with this information. We would also recommend that you keep the amount of personal or confidential information you send to us via email to a minimum.

Online

• Cookies – Cookies are small text files that are placed on your computer by some websites that you visit. They are widely used in order to make websites work, or to make them work more efficiently, as well as to provide information to the owners of the site. Details about how we use Cookies can be found in our Privacy & Cookies Notice which can be found below.
• Other websites – On our website you may find links to other external websites which we have provided for your information and convenience. This privacy notice applies solely to the West Midlands Combined Authority. We are not responsible for the content of those sites. When you visit other websites, we recommend that you take time to read their own privacy notices. Our websites, for example by way of data capture forms.

What we will do with your information

When deciding what personal information to collect, use and hold, we are committed to making sure that we:

• Only collect, hold and use personal information where it is necessary and fair to do so;
• Keep your personal information secure and safe;
• Securely dispose of any personal information when it is no longer needed;
• Be open with you about how we use your information and who we share it with; and
• Adopt and maintain high standards in handling any personal information

We may disclose personal information to a third party, but only where it is required by law, where that third party needs that information to provide you with a service on our behalf or where it is otherwise allowed under the Data Protection Act. We will strive to make sure that the third party has sufficiently robust system and procedures in place to protect your personal information.

How long we will hold your information

By providing you with a service we create records that contain information. We manage our records to help us provide a service to you. The retention periods we will hold records are determined based on the type of record, the nature of the activity, product or service. We will not retain records for any longer than necessary, or as required by law.

When we dispose of personal information we will do so in a secure way.

Who we may share your information with

We will not share your information with anyone outside of the West Midlands Combined Authority except:

a) Where we have your permission
b) Where required for the service we are providing you
c) Where we are required by law and by law enforcement agencies, juridical bodies, government, tax authorities or other regulatory bodies,
d) With third parties, external partners, and agencies assisting us in delivering our service to you.
e) With external partners to improve, and advance, the service we provide to you

Information will only be shared where it is necessary and permitted under the Data Protection Act. Any information shared will be proportionate and limited only to what is necessary.

WMCA will ensure that the third party, external partner, or agency have sufficient systems and procedures in place to prevent the loss or misuse of personal information. Sharing will only take place under strict contractual agreements and/or sharing agreements.

Transferring information overseas

If you’re personal information is transferred outside the European Economic Area (EEA) for processing or storage purposes WMCA will ensure that safeguards are in place to protect it to the same standard we apply. We will ensure that any transfer only takes place if:

a) The European Commission has decided that the country or the organisation we are sharing your information with will protect your information adequately
b) The transfer has been authorised by the relevant data protection authority; and/or
c) We have entered into a contract with the organisation with which we are sharing (on terms approved by the European Commission), to ensure your information is adequately protected.

Communications about our service

We will contact you with information relevant to the service we are providing you. By a variety of means including via email, text message, post and/or telephone.
We may monitor or record calls, emails, text messages, or other communications in accordance with applicable laws.

Your rights

Under the Data Protection Act you, as the Data Subject, have the following rights. Each request will be reviewed and actioned wherever possible. However, you should be aware that, due to the reasons that WMCA may be processing your information we may not be able to comply with some requests due to legal obligation. You have the right to:

Rights	Description
Access – You have a right to get access to the personal information we hold about you	If you would like a copy of the personal information we hold about you please contact us at: ·        Email: Information.officer@wmca.org.uk ·        Telephone: Switchboard – 0121 200 2787; Main Contact Centre – 0345 303 67 60 ·        Address: Data Protection Officer, 16 Summer Lane, Birmingham, B19 3SD
Rectification – You have a right to rectification of inaccurate personal information and to update incomplete personal information	If you believe that any of the information that we hold about you is inaccurate, you have a right to request that we restrict the processing of that information and to rectify the inaccurate personal information. Please note that if you request us to restrict processing your information,  we may have to suspend the services we provide to you
Erasure – You have a right to request that we delete your personal information.	You may request that we delete your personal information if you believe that: ·        we no longer need to process your information for the purposes for which  it was provided; ·        we have requested your permission to process your personal information and you wish to withdraw your consent; or ·        we are not using your information in a lawful manner. Please note that if you request us to restrict processing your information,  we may have to suspend the services we provide to you
Restriction – You have a right to request us to restrict the processing of your personal information	You may request us to restrict processing your personal information if you believe that: ·        any of the information that we hold about you is inaccurate; ·        we no longer need to process your information for the purposes for  which it was provided, but you require the information to establish,  exercise or defend legal claims; or ·        we are not using your information in a lawful manner.   Please note that if you request us to restrict processing your information, we may have to suspend the services we provide to you.
Portability – You have a right  to data portability	Where we have requested your permission to process your personal information or you have provided us with information for the purposes of entering into a contract with us, you have a right to receive the personal information you provided to us in a portable format
Objection – You have a right to object to the processing of your personal information.	You have a right to object to us processing your personal information (and to request us to restrict processing) unless we can demonstrate compelling and legitimate grounds for the processing, which may override  your own interests, or where we need to process your information to investigate and protect us or others from legal claims. Please note that if you request us to restrict processing your information,  we may have to suspend the services we provide to you
Withdraw consent – You have  a right to withdraw your consent	Where we rely on your permission to process your personal information, you have a right to withdraw your consent at any time. We will always make it clear where we need your permission to undertake specific processing activities
Lodge complaints – You have a right to lodge a complaint with the regulator.	If you wish to raise a complaint on how we have handled your personal information, you can contact our Data Protection Officer who will investigate the matter.   We hope that we can address any concerns you may have, but if you remain unhappy you can contact the Information Commissioner’s Office (ICO).  For more information, visit:  ico.org.uk

Using personal information for marketing

We will only send you information about our services if you have asked us to do so or, based on the information we hold, and those services are considered of benefit to you. Your information may also be shared with other service providers who may contact you if they provide services to help you. You can opt out of this at any time by letting us know.

On our websites you have the option to submit your email details to join our Marketing Database. We may ask you for additional details to help tailor your experience. These details are submitted and controlled by you at all times.

Details held for Marketing and Information Updates will be used for sending you relevant information. You have the ability to update your details at any time or unsubscribe from receiving our emails by clicking the preference centre or unsubscribe link placed at the bottom of our emails. Alternatively you may contact us at customerservices@twfm.org.uk to request removal.

We will hold your details on our Marketing Database until you unsubscribe from our Database. If you do not open emails for longer than 6 – 12 months we will remove your details automatically.

No details given for marketing purposes will be shared with third parties.

We may from time to time send you information from our partners if we feel it is relevant to you.

Competitions run in conjunction with our partners may have explicit terms and conditions around data sharing. These will be highlighted to you when you enter the competition.

Use of CCTV

We have installed CCTV systems and Body Worn Video in some of our locations for the purpose of staff and public safety and the prevention and detection of crime. Signs are prominently displayed notifying you that CCTV is in operation and providing you with details of who to contact for further information about them.

We will only disclose CCTV images to third parties for the purposes as stated above of public safety and the prevention and detection of crime. CCTV images will not be released to the media for entertainment purposes or placed on the internet.

You have the right to see CCTV images of yourself and if appropriate provided with a copy.

Prevention and detection of fraud

WMCA is required by law to protect the public funds it administers. Therefore we may use any of the information you provide to us for the prevention and detection of fraud or to comply with the law.

As well as conducting our own ‘data matching’ exercise we may also share your information with other public bodies. These include (but are not limited to):

• The Audit Commission
• Department for Work and Pensions
• Other Local Authorities
• Her Majesty’s Revenue & Customs
• The Police

We may also share information with credit reference agencies, service providers or contractors and partner organisations, where the sharing of information is necessary, proportionate and lawful.

How to contact us

For more information about either requesting access, to stop processing of your personal information or to raise a concern please contact us at:

• Email: Information.officer@wmca.org.uk
• Telephone: Switchboard – 0121 200 2787; Main
• Contact Centre – 0345 303 67 60
• Address: Data Protection Officer 16 Summer Lane, Birmingham, B19 3SD

Complaints

If you wish to raise a complaint on how we have handled your personal information, you can contact our Data Protection Officer who will investigate the matter. Contact details are provided above.

We hope that we can address any concerns you may have, but if you remain unhappy you can you can contact the Information Commissioner’s Office (ICO). For more information, visit: ico.org.uk

Equalities Information

We may use information such as your ethnic background, first language, gender, sexual orientation and age gap to gather statistics about the population of the area and the take up of our services. This is to help comply with our legal obligations and to plan the provision of services in the future.

Such analysis will not identify individuals or have impact on entitlement to services and facilities.

Changes to the way we use information

If we change the way we use your information, and we believe you may not reasonably expect such a change we will notify you and will allow a period of time to raise any objections before the change is made. However, please note that in some cases, if you do not agree to such changes it may not be possible for us to continue to operate your account and/or provide our service to you.

Changes to this Privacy Notice

We keep our privacy notice under regular review. This privacy notice was last updated on May 2018.

Schedule A – Schedule of Purposes of Processing

We will only use and share your information where it is necessary for us to carry out our lawful activities. We want to ensure that you fully understand how your information may be used. We have described the legal purposes for which your information may be used in detail below:

A. Contractual necessity
We may process your information where it is necessary to enter into a contract with you for the provision of a services or to perform our obligations under that contract. This may include processing to:

a) assess and process applications for products or services;
b) provide and administer those products and services throughout your relationship with us, including opening, setting up, updating, or closing the service or product; collecting and issuing all necessary documentation; executing your instructions; processing transactions, resolving any queries or discrepancies and administering any changes.
Calls to our service centre and online helplines may be recorded and monitored for these purposes;
c) manage and maintain our relationship with you and for ongoing customer service. This may involve sharing your information with our partner organisations to improve the availability of our services;
d) communicate with you about the service or the products and services you receive from us, and
e) undertake any processing necessary to provide, deliver, or improve the service to you

B. Legal obligation

When we provide a product or service (and throughout your relationship with us), we are required by law to collect and process certain personal information about you. 

Please note that if you do not agree to provide us with the requested information, it may not be possible for us to continue to provide products and services to you.

C. Legitimate interests of West Midlands Combined Authority

We may process your information where it is in our legitimate interests do so as an organisation, and without prejudicing your interests or fundamental rights and freedoms.

a) We may process your information in the day-to-day running of West Midlands Combined Authority, to manage our services and financial affairs and to protect our customers, employees and property. It is in our interests to ensure that our processes and systems operate effectively and that we can continue operating. This may include processing your information to:
i. monitor, maintain and improve internal processes, information and data, technology and communications solutions and services;
ii. ensure business continuity and disaster recovery and responding to information technology and business incidents and emergencies;
iii. ensure network and information security, including monitoring authorised users’ access to our information technology for the purpose of preventing cyber-attacks, unauthorised use of our telecommunications systems and websites, prevention or detection of crime and protection of your personal data;
iv. provide assurance on our material risks and reporting to internal management and supervisory authorities on whether we are managing them effectively;
v. perform general, financial and regulatory accounting and reporting;
vi. protect our legal rights and interests;
vii. manage and monitor (for example through CCTV) for the purpose of crime prevention and prosecution of offenders, for identifying accidents and incidents and emergency situations and for internal training; and
viii. enable a sale, reorganisation, transfer or other transaction relating to West Midlands Combined Authority.

b) It is in our interest as a business to ensure that we provide you with the most appropriate products and services and that we continually develop and improve as an organisation. This may require processing your information to enable us to:
i. identify new business opportunities and to develop enquiries and leads into applications or proposals for new business and to develop our relationship with you;
ii. send you relevant marketing information which we believe may be of interest to you;
iii. understand our customers’ actions, behaviour, preferences, expectations, feedback and relationship history in order to improve our products and services, develop new products and services;
iv. monitor the performance and effectiveness of products and services;
v. assess the quality of our customer services and to provide staff training. Calls to our service centres and communications to our online helplines may be recorded and monitored for these purposes;
vi. perform analysis on customer complaints for the purposes of preventing errors and process failures and rectifying negative impacts on customers;
vii. combine your information with third-party data, such as economic data in order to understand customers’ needs better and improve our services.
viii. We may share information with third parties who help provide our services under strict contractual agreements protecting your personal data.

c) It is in our interest to manage our risk and to determine what products and services we can offer and the terms of those products and services.

D. Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in West Midlands Combined Authority;

We may process your information where:

a) we are exercising an official authority set out in law
b) to perform a specific task the public interest that is set out in law

E. Consent

For some work we undertake we may only process your information with your consent. If we are processing information with consent we will ensure you are clearly informed of this, and you have the opportunity to provide clear unambiguous consent.